What is CVE-2017-7192?

CVE-2017-7192 is a high-severity vulnerability in Starscream Project, classified under Improper Certificate Validation. CVSS score: 7.5/10. Published 2017-04-06.

How severe is CVE-2017-7192?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Starscream Project

CVE-2017-7192

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).

Vulnerability class: Improper Certificate Validation

EPSS: 0.019 (77.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Starscream_project Starscream
N/a — versions n/a

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Release Notes)
cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2017-7192?: CVE-2017-7192 is a high-severity vulnerability in Starscream Project, classified under Improper Certificate Validation. CVSS score: 7.5/10. Published 2017-04-06.
How severe is CVE-2017-7192?: High severity. CVSS v3 base score is 7.5 out of 10.